BUGFIX #24: toggle_string arguments are now escaped before being inserted into the DOM.

This commit is contained in:
n1474335 2016-11-30 19:33:20 +00:00
parent 09d515cbae
commit 2f0bc54046
5 changed files with 12 additions and 11 deletions

View file

@ -436,7 +436,8 @@ HTMLApp.prototype.set_recipe_config = function(recipe_config) {
} else if (args[j].classList.contains("toggle-string")) {
// toggle_string
args[j].value = recipe_config[i].args[j].string;
args[j].previousSibling.children[0].innerHTML = recipe_config[i].args[j].option +
args[j].previousSibling.children[0].innerHTML =
Utils.escape_html(recipe_config[i].args[j].option) +
" <span class='caret'></span>";
} else {
// all others